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(54) Device for protection against 
the unauthorized reading of pro- 
gram words stored in a memory 

(57) The unauthorized reading of 
program words stored in a memory 
(1) of a data processing system is 
counteracted by supplying the un- 
authorized reader with nuisance 
data frm a data source (8) instead 
of program words from the mem- 
ory. In order to determine whether 
the memory is being read by an 
unauthorized reader or by a data 
processor unit (1 5) of the system 
for the execution of the program, 
use is made of the sequence in 
which the data processor unit reads 
the program words from the mem- 
ory. This sequence deviates (e.g. 
because of jumps) from the se- 
quence in which the program words 
are stored in the memory. Addi- 
tional information is added (14) to 



each program word stored in the 
memory, said additional information 
containing an indication of a subse- 
quent program word to be read by 
the data processor unit. On the ba- 
sis of this additional information it 
is tested (2 1 ) whether the memory 
is being read in the sequence deter- 
mined by the data processor, for 
the execution of the program, or in 
some other (e.g. consecutive) se- 
quence by an unauthorized reader 
who does not know the sequence 
determined by the data processor 
unit. 
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SPECIFICATION 



Arrangement for protection against the unauthorized reading of program words stored in a 
memory 

5 5 
The invention relates to an arrangement for protection against the unauthorized reading of 
program words stored in a memory, notably a program memory, which forms part of a memory 
device, said protection arrangement comprising a data processor unit having an address output 
which is connected to an address input of the memory in order to address the stored program 
10 words during a processing operation in a given sequence which is determined by the data 10 
processor unit. 

Devices which are controlled by a data processor unit comprise a memory, for example, a 
ROM or a PROM, in which programs and other information, (termed software), are stored in the 
form of program words for the execution of data processor operations. The design of such 

1 5 software is time consuming and is also expensive. Therefore, it is important to prevent 1 5 

unauthorised reading of such software. 

A number of methods by which the (software) content of a memory is protected against 
unauthorized reading are already known. For example, H is known to use code words or access 
keys, or so-called protection instructions, which prevent access to the program words stored in 

20 the memory. Such a method is described, for example, in the article 'Computer Program 20 
Protection" by E.J. Sengyel and D.H. Olson published in IBM TDB, Vol. 14, No. 1 1, April 
1972, p. 3531. 

It is a drawback of the known methods that an unsuccessful attempt to copy the software 
from the memory is noticed rather quickly. An unauthorized reader may than find a way of de- 
25 activiating the protection method, so that unauthorized reading can still take place. 25 
It is an object of the invention to provide an arrangement in which unauthorized reading of 
the content of a memory thereof results in the outputting of completely useless information to 
the unauthorized reader, without such reader becoming aware of that during the unauthorized 
reading. 

30 To this end, an arrangement in accordance with the invention is characterised in that the 30 
memory device comprises a selection unit, a verification unit, and a data source which is 
separate from the memory and serves to supply at least one nuisance word which is unrelated to 
said program words, said selection unit comprising a first input which is connected to a first 
output of the memory and a second input which is connected to the output of the data source, 

35 an additional information being added to each program word stored in the memory, a second 35 
output of the memory being connected to a first input of the verification unit in order to present 
said additional information, a second input of the verification unit being connected to a 
connection of the memory in order to present program information thereto, said verification unit 
comprising first means for storing said additional information when a first program word is read 

40 from the memory, said additional information pertaining to a subsequent program word which is 40 
determined by said sequence and which succeeds the first program word, said verification unit 
comprising second means for verifying, when a second program word is read from the memory, 
whether the program information of the read second program word corresponds to the stored 
additional information pertaining to the subsequent program word, and for generating a first 

45 signal when said verification results in correspondance and a second signal when said 45 
verification results in non-correspondance, the selection unit comprising a control input for 
receiving said first and second signals in order to supply the read program word from the 
memory on an output under the control of said first signal and to block the supply of at least 
one program word from the memory under the control of said second signal and to replace this 

50 program word on the output by a nuisance word from the data source. 50 
The program words are stored in the memory in a well-defined sequence. However, the 
sequence in which the program words are fetched by the data processor unit during the 
execution of the program deviates from the well-defined sequence in which the program words 
are stored in the memory. For example, under the control of the data processor unit, "jumps" 

55 are customarily made to, for example, sub-programs. Only the designer of the program and the 55 
data processor unit know the sequence in which the program words have to be read from the 
memory for the execution of the program. An unauthorized reader would not know this 
sequence and will read the program words from the memory in some other sequence, for 
example, one after the other in the sequence in which they have been stored. When the 

60 sequence determined by the data procesor is not respected the first output of the memory will 60 
be blocked in respect of at least one of the program words to be outputted from the memory 
and the program word to be outputted will be replaced by a nuisance word from the data 
source. This nuisance word from the data source is completely useless for the execution of the 
program. This will not be noticed by the unauthorized reader during the copying operation, 

65 because "apparent" program words are outputted on the output of the arrangement as usual. 65 
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However, when this "copied" program is used, it will be realised that it is useless. 

A first preferred embodiment of an arrangement in accordance with the invention is 
characterised in that said connection of the memory comprises an address input of the memory, 
said program information contains at least part of the address of the program word. Said 
5 verification can be simply implemented on the basis of a few bits of the address of the program 5 
word addressed by the data processor unit. 

Preferably, said first means of the verification unit comprises an own register and a memory 
table, a first input of said own register being connected to the first input of the verification unit, 
an output of the data processor unit being connected to a second input of the own register in 
10 order to supply a control signal for a read operation, an output of said own register being 10 
connected to an address input of the memory table which is for the storage of program word 
addresses, said additional information containing an address for a location in the memory table. 
When use is made of such a memory table in which addresses of program words are stored, the 
varification can be performed on all bits of the address word, without a substantial memory 
1 5 space being occupied for the storage of the additional information. 1 5 

A second preferred embodiment of an arrangement in accordance with the invention is 
characterised in that said connection of the memory comprises a data output of the memory, 
said program information contains at least a part of the program word. Thus, in addition to the 
verification on the basis of address words, verification on the basis of the program words 
20 themselves is also possible. 20 

A further preferred embodiment of an arrangement in accordance with the invention is 
characterised in that said program words to be protected are subdivided into two different 
groups, exclusive additional information being added to each program word of a first group, and 
non-exclusive additional information being added to each program word of a second group, said 
25 verification unit comprising recognition means responsive to the recognition of additional 25 
information of said second group and for de-activating the verification unit under the control of 
an additional information of said second group, thus generating a said first signal. 

The addition of exclusive additional information to each program word requires a large 
amount of storage space and the efficiency of the arrangement for protection against the 
30 unauthorised reading is increased only slightly thereby. It suffices to provide only a first group of 30 
program words with exclusive additional information and to add non-exclusive additional 
information to the program words which do not form part of this group; for example, all 
program words of the second group can have the same additional information. Because of this 
division into first and second groups, only a small amount of the storage. space available will be 
35 occupied by the additional information. 35 

Preferably, said data source comprises a random generator. When use is made of a random 
generator, different nuisance program words can be generated each time an unauthorised reader 
attempts to copy the memory content. 

Embodiments of the invention will be described in detail hereinafter, by way of example, with 
40 reference to the accompanying drawing. In the drawings: — 40 

Figure 1a shows an embodiment of an arrangement for protection against unauthorized 
reading in accordance with the invention in which verification is performed on the basis of 
address signals; 

Figure 1b shows a number of waveform diagrams which illustate the operation of an 
45 arrangement in accordance with the invention; 45 
Figure 2 shows a second embodiment of an arrangement in accordance with the invention; 
and 

Figure 3 shows another embodiment of an arrangement in accordance with the invention, in 
which verification is performed on the basis of program words. 

50 A data processing system utilizes a data processor unit for the processing of data in 50 
accordance with a program. This program is stored in a memory, sometimes referred to as the 
program memory, in the form of program words such as, for example, instructions, data etc. 
This memory is usually a non-volutile memory, for example, a ROM, a PROM, EAROM or 
another integrated circuit memory. The program words of a program are stored in the memory 

55 in a given sequence. When the program is executed, the data processor unit will read the . 55 
program words in the memory in a sequence which is determined by the content and the nature 
of the program. The sequence deviates from a given (e.g. sequential) sequence in which the 
program words are stored in the memory. This means that under the control of the data 
processor unit, "jumps" are made in the reading of the program words stored in the memory. 

60 An unauthorized reader does not know the sequence in which the program words are read from 60 
the memory by the data processor unit during the execution of the program. When an 
unauthorized reader attempts to read the program from the memory, he will likely read the 
program words in a sequence (e.g. the sequential sequence) which deviates from the sequence 
used by the data processor unit. 

65 In order to provide protection against unauthorized reading the invention utilizes the fact that 65 



: <GB 2) 19978A_I_> 



GB2119978A 



the unauthorized reader does not know the sequence used by the data processor. 

The invention will be described with reference to a number of embodiments in each of which 
instruction (words) are the chosen program words which are used. However, the invention can 
also be carried out in the same way using data words or any other type of program word. 

5 Fig. 1a shows a simple embodiment of an arrangement for protection against unauthorized 5 
reading in accordance with the invention. A memory device 20 comprises a memory 1, for 
example, a ROM, an address input of which has a width of, for example, 1 1 bits and is 
connected to an address bus 2 of the arrangement. A first data output of the memory 1 is 
connected, via a first data bus 9 of, for example, 8 bits, to a first input of a selection unit 7. A 

10 second data output of the memory 1 is connected to a first input of a verification unit 21 via a 10 
second data bus 1 3. A second input of the verification unit 21 is connected to a number of 
lines, for example, four, of the address bus 2. A second input of the selection unit 7 is 
connected to an output of a data source 8. The selection unit 7 also comprises a control input S 
which is connected to an output of the verification unit 21 . A line 1 1 carries a signal CS {Chip i 

1 5 Select) which is presented to an input CS of the memory 1 and also to a third input of the 1 5 

verification unit 21. This verification unit 21 comprises a comparison unit 3, first, second and 
third inputs of which are connected to the first, second and third inputs, respectively, of the 
verification unit 21 . The first input of the verification unit 21 is also connected to a first input of 
a logic OR-device 4. The verification unit 21 also comprises a logic AND-gate 5, an output of 

20 which is connected to a clock input of a flip-flop 6. The signal CS on the third input of the 20 
verification unit 21 is inverted via an inverter 10 and presented to a first input of the logic AND- 
gate 5. A second input of the logic AND-gate 5 is connected to an output of the comparison 
unit 3 via a line 1 2, and a third input of the logic AND-gate 5 is connected to an output of the 
logic OR-device 4. An output of the flip-flop 6 is connected to the output of the verification unit 

25 21. 25 
In the memory 1 a space 14 of, for example, 4 bits, is reserved for adding to each instruction 
additional information which relates to a next instruction to be fetched by a connected data 
processor unit 1 5 during the execution of the program. 

In the present embodiment, the four most significant bits of the address of the next 

30 instruction to be fetched by the data processor are added to each of a series of instructions in 30 
this space 14, as additional information. It is alternatively possible to use most significant 
address bits of the next instruction to be fetched by the data processor unit as additional 
information for each and every instruction, but a larger storage space is then required while the 
efficiency of the device for protection against unauthorized reading is increased only slightly, as 

35 will be explained hereinafter. Alternatively, instead of most significant bits, least significant bits 35 
or a different combination of bits may be chosen from the address of the next instruction as the 
additional information. For the other instructions which do not belong to said series, the 
additional information contains a fixed value, for example, all bits of the additional information 
have the value zero. Each such other instruction can then be identified as the next instruction. 

40 The program words can thus be subdivided into two groups; namely, a first group in which each 40 
program word contains exclusive additional information and a second group in which the 
additional information is common to all the program words of that second group. It is not 
absolutely necessary for the additional information to relate to the next instruction. The 
additional information may also relate to a further instruction to be fetched by the data processor 

45 unit. However, in that case, the device arrangement requires more elements, for example, a 45 ^ 

counter, so that it becomes more expensive and complex. 

When a first instruction is addressed in the memory 1 by the data processor unit 1 5, the 
additional information associated with the relevant instruction is also addressed. During the * 
addressing of the memory 1, the signal CS is at a low level as appears from Fig. 1b. When the 

50 memory 1 is addressed by the data processor unit 15, the first instruction fetched as well as the 50 
associated additional information will be presented to the first data output and the second data 
output, respectively, of the memory 1 (data signal DAT high, Fig. 1b). The additional 
information associated with the relevant first instruction is transferred, via the second data bus 
13, to the comparison unit 3 in which it is stored, for example, in an own register of the 

55 comparison unit. Because the own register responds to the positive-going edge of the signal CS, 55 
storage takes place when the level of the signal CS changes from low to high. When the data 
processor unit subsequently fetches a second instruction from the memory 1, a comparison 
operation is performed by the comparison unit 3. This comparison operation is performed under 
the control of the negative-going edge of the signal CS and in this embodiment the four most 

60 significant address bits of the address of the second instruction, as presented to the second 60 
input of the comparison unit 3, are compared with the additional information stored in the own 
register of the comparison unit 3. 

The result of the comparison operation is positive when the memory 1 is addressed in the 
correct sequence, as determined by the program of the data processor unit 1 5, i.e. when the 

65 four most significant bits of the address of said second instruction correspond to the four most 65 
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significant bits of the address of said next instruction which are already present in the own 
register as additional information. 

The result of the comparison operation is negative when the memory 1 is addressed in an 
incorrect sequence, for example, when the content of the memory is being copied and the 
5 instructions are not fetched in the sequence determined by the program of the data processor 5 
unit. This is because the address of said second instruction then deviates from the address of 

said next instruction. 

The result of the comparison operation appears in inverted form on an output EQ of the 
comparison unit 3 and is presented, via line 12, to said second input of the logic AND-gate 5. 

10 The first input of the logic AND-gate 5 receives the signal in synchronization with the 10 
fetching of instructions from the memory. 

The logic OR-device 4 has a special function which will be explained in detail hereinafter. As 
has already been stated, not all instructions comprise exclusive additional information; in this 
embodiment the memory 1 contains instructions for which all additional information bits have 

1 5 the value zero (second group). When the additional information of an instruction consists 1 5 

exclusively of zeros, the verification operation will be different. However, these zeros will always 
be applied to the comparison unit 3 when an instruction containing zeros as the additional 
information is fetched by the processor unit. As a result, the comparison operation may be 
negative when zeros are presented. In order to suppress such a negative result, use is made of 

20 the logic OR-device 4. This logic OR-device performs a logic OR-operation on the bits of the 20 
additional information. This means that the result on an output of the logic OR-device 4 
assumes the logic value "1" when at least one of the bits of the additional information deviates 
from zero, the logic value "0" being present on the output of the logic OR-device when all bits 
of the additional information have the value zero. Because the result on the output of the logic 

25 OR-device 4 is only of importance for the next instruction's comparison operation in the 25 
comparison unit 3, it should be outputted only when the next instruction is fetched. Therefore, 
the result of the logic OR-operation is stored in the logoc OR-device 4, for example, by the 
setting of a flip-flop. 

Three cases can be distinguished: 

30 1 . The result of the comparison operation is positive. 30 

2. The result of the comparison operation is negative and the additional information does not 
contain only zeros. 

3. The result of the comparison operation is irrelevant due to the fact that the additional 
information contained only zeros. 

35 These three cases will be separately described hereinafter. 35 

1 . The result of the comparison operation is positive. In this case the value EQ » "0" is 
applied, via the line 1 2, to the second input of the logic AND-gate 5; the output of the logic 
OR-device 4 carries the value OR = "1 " which is presented to a third input of the logic AND- 
gate 5. When an instruction is fetched from the memory 1, the value CS = "1" is applied to a 

40 first input of the logic AND-gate 5. _ 40 
Because E3= "0", OR « "1" and CS = "1", an output of the logic AND-gate 5 outputs a 
logic value "0" which is presented to a clock input of the flip-flop 6. This logic "0" does not 
switch over the flip-flop 6 which is, for example, a D-type flip-flop (the flip-flop is adjusted so 
that it is reset after the switching on of the power supply, i.e. Q = 0), so that a logic value "0" 

45 is also the output on an output Q of the flip-flop 6 for presentation to the control input S of the 45 
selection unit 7. On an output F, the selection unit 7 outputs a signal having the value 
F = A.S. + B.S. This means that, when the input S receives the logic value "0" (S = "0", so 
§ = "1"), the selection unit 7 outputs the instruction fetched from the memory 1 (F = A.1). This 
is because this instruction is presented to the input A of the selection unit 7 via the first data 

50 bus 9. Consequently, when the result of the comparison operation is positive, the correct 50 
instruction is presented to a data input of the data processor unit 1 5 or another user. 

2. The result of the comparison operation is negative and the additional information does not 
contain only zeros. This means that EQ = "1", OR = "1" and 55 = "1" are presented to the 
inputs of the logic AND-gate 5. Cosequently, a logic value "1" is the output on the output of 

55 the logic AND-gate 5. This logic value "1" causes the flip-flop 6 to switch over, so that the 55 
value Qa"l" is the output of the output Q of t*3 ^lip-flop 6 to be presented to the input S of 
the selection unit 7. On the output F, the selection unit outputs the signal F = B.1. This means 
that information from the data source 8 is presented to a user instead of the instruction 
requested from the memory 1 . Thus, an unauthorized reader will receive nuisance information 

60 from the data source 8. 60 

3. The result of the comparison operation is irrelevant due to the fact that the additional 
information contained only zeros. This means that EQ= "1", OR = "0" and CS = "1" are 
presented to the inputs of the logic AND-gate 5. Consequently, a logic "0" is the output on the 
output of the logic-AND gate 5, so that the $p™\e. situation occurs as ; n the f^st case. It is thus 

65 achieved that it is not necessary to add exclusive additional information to each instruction, so 65 
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that the space occupied by the additional information remains limited. 

Several embodiments are feasible for the data source 8, for example, a register, a random 
generator, a memory (different from the memory 1) or simply a connection to ground. The data 
source 8 presents the second input of the selection unit 7 with nuisance data which are not 
5 suitable for the execution of the program. The replacement of the instructions of the memory 1 5 
by nuisance data from the data source 8 ensures that the "copied" program is useless. 
Preferably, the data source 8 does not supply one and the same nuisance word to the input B of 
the selection unit. Such a word would be quickly recognizable by an unauthorized user. By 
presenting different nuisance words to the output F of the selection unit 7, when input B is 
1 0 selected, it will be difficult to establish whether the information provided originates from the 1 0 
memory 1 or from the data source 8. 

The operation of a device according to Fig. 1a will be illustrated on the basis of the example 
given hereinafter. The Table I below gives an example of a part of the content of the memory 1 . 



15 


TABLE I 








Address 


Extra Information (14) 


Instruction/data word 




000000 


000 


set a,b,c,d,e, = 0 


20 


000001 


000 


a = a + 1 




000010 


001 


goto 001000 




00001 1 


000 


read p 




000100 


000 


display p 




000101 


000 


enter b, store b 


25 


000110 


000 


goto 000001 




0001 1 1 


000 


c = c+ 1 




001000 


001 


goto 001010 if 
greater than 1 




001001 


000 


goto 00001 1 


30 


001010 


000 


display b 




001011 


000 


b = b - 1 




001111 


010 


goto 010001 if b less 
than 5 




010000 


001 


goto 001010 


35 


010001 


000 


C = a + b 




010101 


000 


e = a + c 



15 



20 



25 



30 



35 



Suppose now that the program is copied sequentially reading out the successive instructions 

40 (for examples, by incrementing a counter). No problem will arise during the reading out of the 40 
first and the second instruction (addresses 000000 and 000001), because the unauthorized 
copyist follows the sequence determined by the data processor. When the third instruction 
(address 000010) is addressed, the extra information 001 (stored in part 14 of the memory 1), 
formed by the most significant address bits, is fetched and stored in the register of comparison 

45 unit 3. Because the extra information contains a bit having the value 1 , the value 1 is stored at 45 
the output of the OR-gate 4. 

When the fourth instruction (address 00001 1) is fetched, the comparison unit compares the 
most-significant bits of the address presented to the memory, i.e. 000, with the extra 
information, i.e. 001 stored in this register. The result of this comparison is negative (0). This 

50 comparison result is inverted (0 (inverted) = 1 ) at the output of the comparison unit 3. At the 50 
input of the AND-gate 5 there are now presented the values 1,1,1 (comparison unit 3, OR- 
gate 4, (CS (twice inverted)). The output of the AND-gate 5 now has a value 1 which will switch 
the flip-flop 6, thus causing the selection of the input B of the selector 7, i.e. information from 
the data source 8 and not the information "read p" from the memory 1 . The unauthorized 

55 copyist will not notice this because information is outputted. When the fifth instruction) address 55 
000100) is fetched, the comparison between the extra information (000) added to the fourth 
instruction and the most-significant bits of the presented address (000) will have a positive 
result, i.e. inverted output comparison unit = 0, output OR-gate 4 = 0 (or operation on 000), 
and CS (twice inverted « 1). The output of AND-gate 5 will have the value 0, resetting flip-flop 

60 6, so that input A of the selector will again be chosen. 60 
A wrong instruction has thus been introduced between two correct program instructions. 
If this fetching operation would have been executed by the data processor during normal 
execution of the program, the third instruction (goto 0010000) would have been executed. In 
this case the address presented at the address input of the memory by the next instruction after 

65 this goto instruction would have been 001000, i.e. with most-significants bits 001 which in this 65 
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case are equal to the extra information (001) added to the third instruction, thus resulting in a 
positive result of the comparison unit 3 (output 0). The output of the OR-gate 4 for an extra 
information 001 is equal to 1 . Thus, the signals presented at the input of AND-gate 5 are 0, 1, 
1 , giving an output equal to 0, thus selecting input A of the selector 7. 
5 Consider now the instruction stored at the address 001000 (goto 001010 if a greater than 1) 5 
and suppose that the program is copied. By fetching this instruction, the extra information 001 
is stored in the register of the comparison unit 3. By fetching the instruction stored at the next 
address (001001), the comparison will have a positive result (001 extra information = 001 
most-significant address bits), even in the case the program is copied. This is necessary because 

1 0 otherwise the normal execution of the program by the data processor would be disturbed in case 1 0 
that the goto condition is not satisfied. 

Consider now the instruction stored at the address 001001 (goto 00001 1) and suppose 
again that the program is copied. When the instruction stored at the address 001010 is read, 
the comparison result is negative (0 (inverted) = 1), because 001 is not equal to 000. At the 

1 5 output of the OR-gate 4, a signal having the value 0 is presented (extra information is 000). 1 5 
Thus, the signals presented at the input of the AND-gate 5 are 1, 0, 1, giving an output signal 
having the value 0 an thus supplying correct data at the output of the selector 7. This problem 
is solved by the device of Fig. 2 where a comparison is done on the whole address rather than 
on the most significant bits. In the case that jump instructions are stored on addresses having 

20 most-significant bits different from 000, the copying operation is efficiently disturbed by a 20 
device according to Fig. 1a. This is illustrated for the instructions stored at the addresses 
0011 11 and 010000. 

Fig. 2 shows a further embodiment of a device in accordance with the invention. Elements 
which correspond to elements of Fig. 1a are denoted by the same reference numeral. Because 

25 this embodiment is quite similar to the embodiment shown in Fig. 1a, only the differences will 25 
be described herein. The first input of the verification unit 21 is connected to an input of a first 
register 16. An output of the first register 16 is connected to an input of a memory table 1 7, an 
output of which is connected to a first input of the comparison unit 3. Because this embodiment 
comprises a first register and a memory table, the comparison unit 3' does not comprise its own 

30 register as in the embodiment shown in Fig. 1a. All address bits of the address signal presented 30 
to the address input of the memory 1 are presented to the second input of the comparison unit 
3'. 

When a first instruction is fetched from the memory 1 by the processor unit 1 5, the additional 
information associated with this first instruction is transferred on the positive-going edge of the 

35 signal CS to the first register 1 6 in which it is stored. The additional information in this 35 
embodiment contains an address of a memory location in the memory table 17. 

When a second instruction is fetched from the memory 1 , the memory table 1 7 is addressed, 
under the control of the negative-going edge of the signal CS on line 1 1 , by the additional 
information which is associated with the first instruction and which is stored in the first register 

40 16. The addressed memory location in the memory table 1 7 has stored therein the address of 40 
the next instruction which succeeds said first instruction in the sequence determined by the data 
processor unit for the execution of its program. The address stored at the addressed memory 
location in the memory table 1 7 is then presented to the comparison unit 3' in order to be 
compared with the address of the second instruction. The further operation of the memory 

45 device shown in Fig. 2 is completely analogous to that of the device described with reference to 45 
Fig. 1a. 

The advantage of the use of a first register and a memory table is that now the comparison 
operation can be performed on the entire address instead of on a part of the address, without 
substantial space in the memory 1 being required for the storage of additional information. This 

50 is because when, for example, 4 bits are reserved in the memory 1 per instruction word for the 50 
storage of additional information, an effective comparison operation (i.e. a comparison operation 
where the additional information does not have the value zero for each of its bits) can be 
performed on t5 complete addresses (2 4 — 1 = 1 6 — 1 = 1 5, not taking into account 0000). If 
the complete address were written in the memory as additional information, for example, 1 1 bits 

55 would be required in order to obtain the same result, whilst for the present embodiment four 55 
bits suffice. A comparison operation performed on the entire address, moreover, is more reliable 
than a comparison operation performed on only a part of the address, because in the former 
case all bits are tested. 

Fig. 3 shows an embodiment of a device in accordance with the invention in which the 

60 verification operation is performed on the instruction word. Elements which correspond to those 60 
of Fig. 1a are again denoted by the same reference numerals and only the differences will be 
described herein. 

The first data output of the memory 1 is connected on the one hand, via the first data bus 9, 
to the first (A) input of the selection unit 7 and on the other hand to the second input of the 
65 verification unit 21 . 65 
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In the present embodiment, the additional information contains a few bits, for example, the 
most significant bits, of a subsequent instruction word to be fetched by the processor unit. 
During a comparison operation, this additional information is compared in the comparison unit 3 
with a second instruction word fetched. Again three cases can be distinguished, as regards the 
5 result of the comparison operation, as described with reference to Fig. 1a. 5 

Evidently, an embodiment as described with reference to Fig. 2, in which the verification unit 
also comprises a first register and a memory table, can be used for a memory device in 
accordance with the invention in which the verification operation is performed on the instruction 
word. 

1 0 Random access parts of the memory, for example, index tables or given data words, can be 1 0 
protected by an imposing, for example, the following validity criterion: 
start address index table^next address^last address index table. However, the protection of 
these parts may be omitted, if desired. This is because an unauthorized reader does not know 
which part of the memory is protected; this is inter alia due to the fact that correct information 

1 5 can not be distinguished from information from the data source 8. 15 
The entire memory device 20 may be constructed in integrated form. An integrated version is 
to be perferred over a version comprising discrete components, because in the latter version a 
smart unauthorized reader might successfully block the selection unit 7 in a state F = A.1 . 
A device for protection against the unauthorized reading of program words stored in a 

20 memory of the described kind is used notably in data processing systems which are sold in 20 
comparatively large numbers. Examples of such systems are video games. 

CLAIMS 

1 . An arrangement for protection against the unauthorized reading of program words stored 

25 in a memory, notably a program memory, which forms part of a memory unit, said protection 25 
arrangement comprising a data processor unit having an address output which is connected to 
an address input of the memory in order to address the stored program words during a 
processing operation in a given sequence which is determined by the data processor unit, 
characterised in that the memory unit comprises a selection unit, a verification unit, and a data 

30 source which is separate from the memory and serves to supply at least one nuisance word 30 
which is unrelated to said program words, said selection unit comprising a first input which is 
connected to a first output of the memory and a second input which is connected to the output 
of the data source, additional information being added to each program word stored in the 
memory, a second output of the memory being connected to a first input of the verification unit 

35 in order to present said additional information thereto, a second input of the verification unit 35 
being connected to a connection of of the memory in order to present program information, said 
verification unit comprising first means for storing said additional information when a first 
program word is read from the memory, said additional information pertaining to a subsequent 
program word which is determined by said sequence and which succeeds the first program 

40 word, said verification unit comprising second means for verifying, when a second program 40 
word is read from the memory, whether the program information of the read second program 
word corresponds to the stored additional information pertaining to the subsequent program- 
word, and for generating a first signal when said verification results in correspondence and, a 
second singal when said verification results in non-correspondence, the selection unit comprising 

45 a control input for receiving said first and second signals in order to supply the read program 45 
word from the memory on an output under the control of said first signal and to block the 
supply of the read program word from the memory under the control of said second signal and 
to replace this read program word on the output by a nuisance word from the data source. 

2. An arrangement as claimed in Claim 1 , characterised in that said connection of the 

50 memory comprises an address input of the memory, said program information containing at 50 
least a part of the address of the program word. 

3. An arrangement as claimed in Claim 2, characterised in that said first means of the 
verification unit comprises an own register and a memory table, a first input of said own register 
being connected to the first input of the verification unit, an output of the data processor unit 

55 being connected to a second input of the own register in order to supply a control signal for a 55 
read operation, an output of said own register being connected to an address input of the 
memory table which is for the storage of program word addresses, said additional information 
containing an address for a location in the memory table. 

4. An arrangement as claimed in Claim 1, characterised in that said connection of the 

60 memory comprises a data output of the memory, said program information containing at least a 60 
part of the program word. 

5. An arrangement as claimed in Claim 4, characterised in that said first means of the 
verification unit comprises an own register and a memory table, said own register comprising a 
first input which is connected to the first input of the verification unit, an output of the data 

65 processor unit being connected to a second input of the own register in order to supply a control 65 
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signal for a read operation, said own register comprising an output which is connected to an 
address input of the memory table which is for the storage of program words, said additional 
information containing an address for a location in the memory table. 

6. An arrangement as claimed in any of the preceding Claims, characterised in that second 

5 means of the verification unit comprises a comparison unit. 5 

7. An arrangement as claimed in Claim 6, characterised in that said program words to be 
protected are subdivided into two different groups, exclusive additional information being added 
to each program word of a first group, and non-exclusive additional information being added to 
each program word of a second group, said verification unit comprising recognition means 

10 responsive to the recognition of additional information of said second group for de-activating the 10 
verification unit under the control of an additional information of said second group, thus 
generating a said first signal. 

8. An arrangement as claimed in any of the preceding Claims, characterised in that said data 
source comprises a random generator. 

15 9. An arrangement as claimed in any of the Claims 1 to 6, characterised in tht said data 1 5 

source comprises a register. 

10. A memory unit for use in an arrangement as claimed in any of the preceding Claims, 
characterised in that the memory unit comprises a memory, a selection unit, a verification unit 
and a data source outside the memory, a first output and a second output of the memory being 

20 connected to a first input of the selection unit and a first input of the verification unit, 20 
respectively, an output of the verification unit being connected to a control input of the selection 
unit and a second input of the selection unit being connected to an output of the data source. 

11. A memory unit as claimed in Claim 10, characterised in that the verification unit 
comprises a comparison unit which comprises an input which establishes a connection to the 

25 first input of the verification unit. 25 

12. A memory unit as claimed in Claim 10, or 1 1, characterised in that the memory is a 
non-volatile memory. 

13. A memory unit as claimed in Claim 10, 1 1 or 12, characterised in that the memory unit 
is constructed using an integrated circuit technique. 

30 14. A video game comprising a memory unit as claimed in any of the Claims 10, 11, 12 or 30 
13. 

15. A memory for the storage of program words for use in a memory unit as claimed in any 
of the Claims 1 0, 1 1 , 1 2, or 1 3. 

16. A data processing system comprising a memory unit as claimed in any of the Claims 10, 

35 11, 12 or 13. 35 

17. An arrangement for protection against unauthorized reading of program words stored in 
a memory, substantially as hereinbefore described with reference to the accompanying draw- 
ings. 
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